Obligations Map October 2024

US State SensitiveData Definitions

Last updated: October 25, 2024

Start

Obligation List

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Unique Identification Numbers

CA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Financial and Account Information

CA, NJ

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Geolocation

CA, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Personal Characteristics

CA*, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Mail, Email, and Text Messages

CA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Genetic

CA, CO, CT, DE, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Biometric

CA, CO, CT, DE, IA, IL, IN, KY, MD, MN, MT, NE, NH, NJ, RI, OR, TN, TX, UT, VA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Sex Life, Sexual Orientation, or Status as Transgender or Nonbinary

††

† ††

CA CO , CT , DE , IA, IN, KY, MD , MN, MT , NE, NH , NJ , RI , OR , TN, TX, UT, VA

††

† ††

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Mental or Physical HealthCondition or Diagnosis

¶ §

¶ §

¶ §

¶ §

¶ §

CO CT DE IA IN KY MN MT NE NH NJ OR RI TN TX UT VA

¶ § ||

¶ §

¶ §

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Children's Data

CO**, CT**, DE, FL***, IA, IN, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, VA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Victim of a Crime

CT, OR

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Consumer Health

CA, CT, MD, NV, WA

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Biological

CA, CO

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical* beliefs, union membership*) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life† sexual orientation, or status as transgender or nonbinary†† Mental or physical health condition¶ or diagnosis,§ or medical treatment|| by a health care professional,# Personal data collected from a known child (under 13, 18** for online product/service/feature, 18 for all***) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Inferences

CA, NV, WA

CHD Only

CHD Only

10

11

12

13

14

US State Sensitive Data Definitions

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life, sexual orientation, or status as transgender or nonbinary Mental or physical health condition or diagnosis, or medical treatment by a health care professional Personal data collected from a known child (under 18 years of age) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumerand that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

Unique identification numbers (social security, driver’s license, state identification card, or passport numbers) Financial and account information (such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account) Precise or specific geolocation Personal characteristics (racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership) The contents of mail, email, and text messages, unless the company is the intended recipient of the communication Genetic data (including public genetic data) The processing of biometric information for the purpose of uniquely identifying a consumer Sex life, sexual orientation, or status as transgender or nonbinary Mental or physical health condition or diagnosis, or medical treatment by a health care professional Personal data collected from a known child (under 18 years of age) Data concerning an individual’s status as a victim of crime Consumer health data, including personal information that is linked or reasonably linkable to a consumerand that identifies the consumer’s past, present, or future physical or mental health status Biological data (including neural data) Inferences drawn from any of the above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes

10

11

12

13

14